The era of COVID-19 has brought enormous suffering and persistent uncertainty to New Yorkers. Adding to both the financial and psychological pain of the pandemic is a dramatic increase in identity theft during the past year. 

More than 67,000 complaints of identity theft were reported in New York state during 2020, according to the Federal Trade Commission (FTC). That was a record number, up 85 percent from the previous year and more than four times the figure of a decade earlier.

Whether identity theft involves credit cards, bank accounts, business or personal loans, government benefits, or other types of transactions, it carries significant risk of financial loss to the victim. The U.S. Department of Justice reported $15.1 billion in financial losses nationwide in 2018. Even when there is no direct monetary loss, addressing the consequences of stolen personal information can take months of complicated work with banks, utility companies, medical offices, and others. Sometimes the worst damage comes later, when victims have trouble getting a job, renting an apartment, obtaining a tax benefit, or receiving a loan because of a stolen identity.

New York State has taken numerous steps in recent years to address identity theft, which is punishable by up to seven years in prison, and to require that businesses and state agencies safeguard private personal information. But clearly, more must be done.

Each of us can and should take common-sense steps such as making sure to keep Social Security numbers confidential and being careful to limit use of birth dates and other personal information in online communications — including social media.

Governmental and independent consumer advocates offer a number of other recommendations for individuals.

As policy makers at all levels of government consider additional responses to identity theft, private businesses large and small that collect and maintain personal information must redouble their efforts to safeguard such data. Social-media companies, whose business models rely heavily on personal information, should take steps to promote best practices, such as educating users about ways to keep private information confidential. Working together, we can reverse the rising tide of identity theft.          

Thomas P. DiNapoli is the New York State Comptroller. This article is drawn from the executive summary to a report, titled, “The Increasing Threat of Identity Theft,” which his office issued in May. To check out the full report, visit: https://www.osc.state.ny.us/files/reports/pdf/increasing-threat-of-identity-tBheft.pdf      

Cybersecurity breaches are nothing new, but several high-profile cases recently are bringing new attention to a serious and growing problem. Malicious actors are getting more sophisticated in their attempts to subvert systems, using tactics such as spear-phishing to prey upon employees’ willingness and desire to be helpful. 

The average cost of a breach in the U.S. is $242 per record. Regaining trust and repairing a corporate reputation could add on to that expense significantly.

The fact that this is a growing problem is undeniable. There are a lot of reasons for the rise in cybercrime, including the sudden switch to remote work brought about by the COVID-19 pandemic. But even when employees are in the office, it’s easy to fall for a phishing scam, or leave systems vulnerable due to poor password habits. Here are just a few of the top vulnerabilities:

• Weak passwords — Choosing overly simple or easily guessed passwords is a long-standing risk.

• Unrestricted web browsing — Accessing the web is a modern business tool that can have many advantages, but unrestricted web browsing can lead employees to accessing sites riddled with malware, putting your systems at risk.

• Social-engineering scams — Social-engineering scams capitalize on the desire of employees to be helpful. Some of these scams might even happen over the phone, with scammers posing as coworkers or vendors, tricking your employees into disclosing passwords or bank-account numbers.

• Phishing, spear-phishing, and link scams — Email scams are widespread. Typically, an employee will receive an email that appears to be from a trusted source, such as a bank or vendor website, and will ask an employee to click a link to verify their account information. Once this process is complete, the attacker has access to your private information.

• Poor document control — Unlocked file cabinets, post-it notes that contain the latest passwords to systems, storing sensitive information in easily accessible files, discarded paperwork that remains un-shredded, and even documents left on printers are all examples of weak document security that could compromise your systems.

• Outdated or disabled browser-security software — Without the latest versions of anti-virus software in use on every machine, your office could be vulnerable.

Examining this list, it’s clear that malicious actors have two primary means by which to gain access to your systems: through holes in your technology, or by manipulating your employees. Businesses are aware that this is a problem, yet still can struggle to implement measures that will harden their cybersecurity defenses. Why is there such a disconnect?

Cost is frequently mentioned as a factor in delaying cybersecurity improvements. Although it is true that businesses may have additional IT expenses, especially if they are still using outdated hardware and software, the costs of upgrading systems will likely pale in comparison to the financial and reputational costs of a breach.

The most impactful step companies can take in hardening their cybersecurity defenses is training employees. All breaches share one commonality: educating people can reduce the rate of these attacks.

Cybersecurity training is not a one-time event. Rather, it is ongoing learning that will make the biggest difference. Short, frequent training will have a lasting impact — and, recurrent lessons allow for changes to be made in training, to adapt as malicious actors change their tactics. I’m reminded of Ben Franklin’s quote: “Tell me and I forget, teach me and I may remember, involve me and I learn.” 

You’ll need to involve every employee. Each person who has access to email or who uses your computers must be trained — including interns, and all the way up to the CEO. Malicious actors have become very adept at mimicking legitimate websites, and whether it is through a lack of understanding, carelessness, or unfamiliarity with the risks, employees are putting companies at risk.

Training doesn’t have to be expensive. Leaders should look to third parties to conduct training as threats and tactics so quickly evolve. Video training is available at a reasonable dollar amount, and the Center for Internet Security has a list of free resources. 

Cybersecurity training is one of the most essential steps you can take to protect your business. If you need help, reach out to your financial institution for recommendations. It, along with organizations such as the Cybersecurity and Infrastructure Security Agency (CISA), the Small Business Administration (SBA), and the Department of Homeland Security (DHS) have resources and help for companies of all sizes.        

Terra Carnrike-Granata is senior VP and director of information security at NBT Bank. She is responsible for designing and implementing sophisticated controls to prevent loss and mitigate risk, while also developing innovative ways to educate consumers and businesses on cyber threats — helping to keep companies and consumers protected. For more information, visit www.nbtbank.com/businessfraudinfo.